When I try to request a certificate, using certbot run, it fails with
Certbot failed to authenticate some domains (authenticator: nginx). The Certificate Authority reported these problems:
Domain: lubel.me
Type: unauthorized
Detail: 3.33.251.168: Invalid response from http://lubel.me/.well-known/acme-challenge/yaou05cxqC334XiFC2Aty0s8wHFmY1mpXORWNodcdGU: 403
Hint: The Certificate Authority failed to verify the temporary nginx configuration changes made by Certbot. Ensure the listed domains point to this nginx server and that it is accessible from the internet.
When I try to point my browser at my static IP to check nginx is accessible from the Internet, it fails with
Forbidden
Rejected request from RFC1918 IP to public server address
I know you would like me to provide all the software and OS types and versions but I have a slightly more fundamental misunderstanding from the many (somewhat contradictory) examples available on the Web. If the answer to the following question doesn't set things right, I'll post all the more intimate details in a new question.
All the examples are very specific to the OS or Webserver being used but (insofar as I can see) don't explain the principles. I'm very much a 'teach a man to fish' not a 'give a man a fish' person and so what I'd really appreciate is a simple explanation of the concepts and principles. The main confusion for me is: does certbot want to look in:
/srv/www/letsencrypt/OR/srv/www/lubel.me/OR/srv/www/lubel.me/letsencryptOR- some other path?
I'm on OpenSuSe Tumbleweed and the nginx config seems to be in /etc/nginx/nginx.conf, which has an events section and a longer http section, which includes an include conf.d/*.conf; statement but conf.d is empty
Snippet of conf file - is this the correct config file in OpenSuSe?
events {
multi_accept on;
worker_connections 1024;
}
http {
include mime.types;
default_type application/octet-stream;
#log_format main '$time_local - $http_host - $remote_addr - $status "$request" $body_bytes_sent - $http_referer - "$http_user_agent"';
#access_log /var/log/nginx/access.log main;
http2 on;
sendfile on;
#tcp_nopush on;
#tcp_nodelay on;
#keepalive_timeout 0;
keepalive_timeout 70;
#gzip on;
include conf.d/*.conf;
server {
listen 80;
# server_name localhost;
server_name lubel.me;
# Include location directive for Let's Encrypt ACME Challenge
include /etc/nginx/snippets/letsencrypt-acme-challenge.conf;
# ------------------------------------------------------------
#access_log /var/log/nginx/host.access.log main;
location / {
# root /srv/www/htdocs;
root /srv/www/lubel.me;
index index.html index.htm;
autoindex on;
autoindex_exact_size off;
autoindex_format html;
autoindex_localtime on;
}
include vhosts.d/*.conf;
}
File hierarchy of served content - Probably needs a tidy up?
tree -L 5 -a /srv/www/lubel.me
/srv/www/lubel.me
├── html
│ ├── index.html
│ └── letsencrypt
│ └── .well-known
│ └── acme-challenge
│ └── index.html
└── .well-known
└── acme-challenge
└── ping.txt
